如何使用 boto3 创建特定类型的 IAM 角色？

Question

I'm trying to lock down a user to a specific VPC in AWS and following How to Help Lock Down a User's Amazon EC2 Capabilities to a Single VPC | AWS Security Blog .

It is mentioned that we need to create an IAM role with name VPCLockDown of type AWS Service

and add the services for which the role needs access to. like ec2 , lambda etc.

I was trying to create this role programatically using boto3 .

I checked the create_role documentation for creating a role using boto3 .

However, they haven't mentioned anything to specify the type of role and the services that I can specify that the role should have access to.

Is there any way to specify these items while creation of the IAM role using boto3

Edit1:

I tried creating a service_linked_role as per Sudarshan Rampuria 's answer like

response = iam.create_service_linked_role(
            AWSServiceName='ec2.amazonaws.com',
        )

But getting the following error:

An error occurred (AccessDenied) when calling the CreateServiceLinkedRole operation: Cannot find Service Linked Role template for ec2.amazonaws.com

Answer 1

You can use create_service_linked_role() function boto3 to link a role to a service. https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.create_service_linked_role

Answer 2

Here is a policy that allows a specific IAM User to launch an instance ( RunInstances ), but only in a given VPC:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2RunInstancesVPC",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": "arn:aws:ec2:ap-southeast-2:111111111111:subnet/*",
            "Condition": {
                "StringEquals": {
                    "ec2:vpc": "arn:aws:ec2:ap-southeast-2:111111111111:vpc/vpc-abcd1234"  <--- Change this
                }
            }
        },
        {
            "Sid": "RemainingRunInstancePermissions",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:ap-southeast-2:111111111111:instance/*",
                "arn:aws:ec2:ap-southeast-2:111111111111:volume/*",
                "arn:aws:ec2:ap-southeast-2::image/*",
                "arn:aws:ec2:ap-southeast-2::snapshot/*",
                "arn:aws:ec2:ap-southeast-2:111111111111:network-interface/*",
                "arn:aws:ec2:ap-southeast-2:111111111111:key-pair/*",
                "arn:aws:ec2:ap-southeast-2:111111111111:security-group/*"
            ]
        }
    ]
}

You might need to change the Region. (I tested it in the Sydney region.)